Summary

Recipient can front run the SablierFlowBase::setProtocolFee transaction, when the new fee is higher than the old fee and SablierFlow:withdraw the funds at a lower fees.

Vulnerability Details

Lets take a simple example where there is a single stream exists inside a flow protocol which has a deposit of 100 Tokens and the intital protcol fees was zero. After one month of creation of this stream, flow protocol decides to set a protocol fee of 5%, expecting that when recipeint will withdraw their funds they will get 5 Tokens. Recipient had already setup for monitoring change in protocol fees transactions, he will frontrun the protocol fee transation and will withdraw the tokens.

Impact

Protocol will lose on the fees.

Tools Used

Manual Review

Recommendations

Protocol should use Flashbots to when changing the protocol fee to prevent frontrunning attacks